Lane B: the recall tier, the candidate contract and the pipeline

[tom-snyder]

Phase 6 of the plan: Lane B, first-party source, built as a recall tier with no model, as the gate decided.

What changed

• The owner's rule selection (data/rules/selection.json, 2026-10-03) narrows the recall federation to budget: 0xdea's noisy bad-words rule, the assert rules (bandit B101 and GitLab's), ten 0xdea code-review heuristics, and test, doc and example trees are out. GitLab's c/ rules are excluded on licence grounds: each is headed "License: GPL 2.0" (generated from flawfinder), under a repository LICENSE that says MIT.
• Vendored rule pack (data/rules): 177 rule files (GitLab sast-rules at 53bf5cf6, six directories: 59 MIT, 27 Apache-2.0 from gosec, 52 Apache-2.0 from bandit; 0xdea at dae50da6, 39 MIT), their licence bodies, and a per-rule provenance manifest generated by python -m anvil_eval.vendor_rules. A GitLab rule's licence is the stricter of its own header and its companion test file's; 131 rules ported from LGPL-3.0 find-sec-bugs and security-code-scan are excluded (the owner's decision after the review), and any other licence outside MIT and Apache-2.0 refuses the run.
• internal/recall: opengrep 1.26.0, gosec 2.29.0 and bandit 1.9.4 as subprocesses, version-checked against their pins; absent, failed and clean are three different answers; the scanned repository's suppressions (nosemgrep, #nosec, # nosec, .semgrepignore, .bandit, bandit's and opengrep's silent default excludes) are all switched off; gosec's file coverage is counted (build tags, cgo, Go outside a module are incomplete coverage) and cgo is off while it loads packages; candidates carry a parser-named enclosing function, the CWE, the untrusted snippet and full provenance.
• internal/laneb: every candidate becomes an unconfirmed SAST finding (confidence 1, no model, no rank), cites its rule in tool.extensions with anvil/ruleProvenance, and checked-in API specs are harvested onto the SAST run for the dynamic tier.
• Record 1.1.0 (additive): run.tool.extensions[], result.rule, anvil/ruleProvenance; wire schema updated. Store migration 0002: scan_run.recall_candidates, the per-scan count.
• The scan: anvil scan --repo runs each lane its configuration enables and its policy allows; Lane B is on by default (recall:); a lane left off is stated, and a scan with nothing found and a lane off exits 3, never 0. anvil recall PATH prints candidates without recording.
• Evaluation: candidates-per-scan re-measured through anvil recall on the 177-rule pack: curl 225 (was 10,714), Anvil 79, flask 9, express 2, spring-petclinic 0; largest push 27 (was 88). Under both bars. The row's decision is left as it was.
• Known limit, kept by the owner: the path exclusions match by name, so a repository can hide code under spec/ or docs/; stated in the README and CONTRACT.md.
• No ranker: the owner's decision; nothing is labelled, and on PrimeVul both rankers were at chance.
• CI: a new job, "Lane B end to end (real tools)", installs the pinned tools by digest, runs the real-tools fixture test with a fatal opt-in and test/e2e/laneb.sh, and proves the opt-in is fatal by hiding opengrep.
• Docs: CONTRACT.md amendment, NOTICE §1a, THIRD-PARTY-LICENSES.md, README per-language coverage, data/LICENSES/opengrep-binary-distribution.md (the packaging choice, left to the owner), docs/gates/lane-b.json (the exit gate, row by row) and docs/reviews/lane-b-gate.md (the same-family adversarial review).

How it was checked

gofmt, go vet ./..., go test -count=1 ./... and -race, with and without Trivy; eval ruff and 165 tests; test/e2e/fixture.sh and test/e2e/laneb.sh with the real tools. Guards seen failing before trusted: removing --disable-nosem, --ignore-nosec or bandit's exclude sentinel, disabling the GitLab directory allowlist or the symlink handling, planting a third-party import, and mapping a candidate to true_positive each fail a test. A same-family adversarial review found two blocking and six should-fix issues; every one is fixed or decided by the owner (docs/reviews/lane-b-gate.md).